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Computer Crime Section 


1275 Drummers Lane, Suite 302 
Wayne, PA 19087 


November 22, 2016 


VIA FIRST CLASS U.S. MATT 
Office of the Virginia Attorney General 
Attn: Computer Crime Section 
900 East Main Street 
Richmond, VA 23219 

Re: Notice of Data Security Incident 

Dear Sir or Madam: 

We represent Brennan Recupero Cascione Scungio and McAllister LLP, 362 Broadway 
Providence, Rhode Island 02009 (“Brennan Recupero”), and are writing to notify you of a data 
security incident that may affect the security of the personal information of two (2) Virginia 
residents. The investigation into this incident is ongoing and will be supplemented with any new 
significant facts learned subsequent to its submission. By providing this notice, Brennan Recupero 

does not waive any rights or defenses regarding the applicability of Virginia law or personal 
jurisdiction. 


Nature of the Cyber Security Incident 

On August 15, 2016, the credentials for a Brennan Recupero attorney were briefly used by an 
unauthorized individual to remotely access its computer network. The unauthorized access was 
quickly discovered and Brennan Recupero immediately reset all user passwords to the network to 
prevent any further access to the network. In addition, Brennan Recupero launched an internal 
investigation and retained third-party forensic experts to determine whether the unauthorized 
individual accessed any data within out network and if so, the extent of that access Brennan 
Recupero determined that while the unauthorized individual or individuals had access to Brennan 
Recupero s network, certain personal information was accessible and may have been viewed by 
the unauthorized individual including individuals’ names, Social Security number and address. 
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On or around October 10, 2016, Brennan Recupero and its forensic experts completed a review 
of the files accessible to identify those whose information was accessible and the type of 
information related to these individuals that was contained in the accessible files. This review 
process involved both a programmatic and manual review of a variety of different file types to 
identify those who may be impacted. Given the complexity and volume of documents to be 
reviewed, this process took some time once the accessible files were identified. Brennan 
Recupero then moved to provide notice to the identified individuals who may be affected by this 
incident. 

On November 22, 2016, Brennan Recupero began mailing notice letters to potentially affected 
individuals which includes two (2) Virginia residents. The notice will be provided in substantially 
the same form as the letter attached here as Exhibit A. 

Other Steps Taken 

Brennan Recupero is offering potentially affected individuals complimentary access to twelve 
(12) months of free credit monitoring and identity restoration services with AllClear ID. 
Additionally, Brennan Recupero is providing potentially affected individuals with information 
on how to protect against identity theft and fraud, including information on how to contact 
the Federal Trade Commission, the state attorney general, and law enforcement to report any 
attempted or actual identity theft and fraud. In addition to providing notice of this incident to 
you, Brennan Recupero is providing written notice of this incident to other state regulators 
where required. 


Contact Information 

Should you have any questions regarding this notification or other aspects of the cyber security 
incident, please contact me at (267) 930-4786. 


Very Truly Yours, 



MULLEN COUGHLIN LLC 
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Brennan, Recupero, Cascione, Scungio & McAllister, LLP 
Attorneys At Law 

Processing Center • P.O. BOX 141578 • Austin, TX 78714 
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JOHN Q. SAMPLE 
1234 MAIN STREET 
ANYTOWN US 12345-6789 


November 22, 2016 

RE: Notice of Data Breach 
Dear John Sample, 

Brennan Recupero Cascione Scungio and McAllister LLP (“Brennan Recupero”) recently discovered an incident that may 
affect the security of your personal information. We write to provide you with information about the incident, steps taken 
since discovering the incident, and information on what you can do to better protect against the possibility of identity theft 
and fraud. 

What Happened? On August 15, 2016, the credentials for a Brennan Recupero attorney were briefly used by an 
unauthorized individual to remotely access our computer network. The unauthorized access was quickly discovered and 
we immediately reset all user passwords to the network to prevent any further access to the network. In addition, we 
launched an internal investigation and retained third-party forensic experts to determine whether the unauthorized 
individual accessed any data within out network and if so, the extent of that access. 

What Information Was Involved? We determined that while the unauthorized individual or individuals had access to 
Brennan Recupero s network, certain of your personal information was accessible and may have been viewed by the 
unauthorized individual including your name, Social Security number and address. 

What We Are Doing Brennan Recupero takes the security of your personal information very seriously. While we have 
no evidence your information was specifically impacted or that your information has been misused, we are offering you 
complimentary access to 12 months of free credit monitoring and identity restoration services with AllClear ID. The 
enclosed Steps You Can Take To Protect Against Identity Theft and Fraud contains instructions on how to enroll and 
receive these free services, as well as information on what you can do to better protect against identity theft and fraud. 
We are also notifying certain state regulators of this incident. 

What You Can Do You can enroll to receive the free credit monitoring and identity restoration services. You can also 
review the enclosed Steps You Can Take to Protect Against Identity Theft and Fraud. 

For More Information You can call the call center we have set up for this incident at 1-855-865-6894. The call center 
is available Monday through Saturday, 9:00 a.m. to 9:00 p.m. E.S.T. 
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We take the privacy of your personal information seriously. We sincerely regret any inconvenience or concern this 
incident has caused you. The security of your information is a priority to us and we have taken precautionary measures to 
better prevent something like this from happening again. 

Sincerely, 

Smjaww "7K, Scmyia 7R.<M<dd *?. &ucio*te 

Benjamin M. Scungio Ronald F. Cascione 





Steps You Can Take to Protect Against Identity Theft and Fraud 

As an added precaution, we have arranged to have AllClear ID protect your identity for 12 months at no cost to you. The 
following identity protection services start on the date of this notice and you can use them at any time during the next 12 
months. 

AllClear Identity Repair: This service is automatically available to you with no enrollment required. If a problem arises, 
simply call 1-855-865-6894 and a dedicated investigator will help recover financial losses, restore your credit and make 
sure your identity is returned to its proper condition. 


AllClear Credit Monitoring: This service offers additional layers of protection including credit monitoring and a $1 
million identity theft insurance policy. For a child under 18 years old, AllClear ID ChildScan identifies acts of credit, 
criminal, medical or employment fraud against children by searching thousands of public databases for use of your child’s 
information. To use this service, you will need to provide your personal information to AllClear ID. 

You may sign up online at enroll.allclearid.com or by phone by calling 1-855-865-6894 using the following redemption 
code: Redemption Code. 

Please note: Additional steps may be required by you in order to activate your phone alerts and monitoring options. 

We encourage you to remain vigilant against incidents of identity theft and fraud, to review your account statements, and 
to monitor your credit reports for suspicious activity. Under U.S. law you are entitled to one free credit report annually 
from each of the three major credit reporting bureaus. To order your free credit report, visit www.annualcreditreport.com 
or call, toll-free, 1-877-322-8228. You may also contact the three major credit bureaus directly to request a free copy of 
your credit report. ' ' 


At no charge, you can also have these credit bureaus place a “fraud alert” on your file that alerts creditors to take 
additional steps to verify your identity prior to granting credit in your name. Note, however, that because it tells creditors 
to follow certain procedures to protect you, it may also delay your ability to obtain credit while the agency verifies your 
identity. As soon as one credit bureau confirms your fraud alert, the others are notified to place fraud alerts on your file. 
Should you wish to place a fraud alert, or should you have any questions regarding your credit report, please contact any 
one of the agencies listed below. 


Equifax 

P.O. Box 105069 
Atlanta, GA 30348 
800-525-6285 
www.equifax.com 


Experian 
P.O. Box 2002 
Allen, TX 75013 
888-397-3742 
www.experian.com 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
800-680-7289 
www.transunion.com 


You may also place a security freeze on your credit reports. A security freeze prohibits a credit bureau from releasing any 
information from a consumer’s credit report without the consumer’s written authorization. However, please be advised 
that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any 
requests you make for new loans, credit mortgages, employment, housing, or other services. If you have been a victim of 
identity theft, and you provide the credit bureau with a valid police report, it cannot charge you to place, list or remove a 
security freeze. In all other cases, a credit bureau may charge you a fee to place, temporarily lift, or permanently remove a 
security freeze. You will need to place a security freeze separately with each of the three major credit bureaus listed 
above if you wish to place a freeze on all of your credit files. To find out more on how to place a security freeze, you can 
use the following contact information: 


Equifax Security Freeze 

P.O. Box 105788 

Atlanta, GA 30348 

1-800-685-1111 

(NY residents please call 

1-800-349-9960) 

https://www.freeze.equifax.com 


Experian Security Freeze 
P.O. Box 9554 
Allen, TX 75013 
1-888-397-3742 

www.experian.com/freeze/center.html 


TransUnion 
P.O. Box 2000 
Chester, PA 19022-2000 
1-888-909-8872 

www.transunion.com/securityfreeze 



You can further educate yourself regarding identity theft, fraud alerts, and the steps you can take to protect yourself, by 
contacting the Federal Trade Commission or your state Attorney General. For North Carolina residents, the Attorney 
General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001, 1-919-716-6400, www.ncdoj.gov. For 
Maryland residents, the Attorney General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202, 1- 
888-743-0023, www.oag.state.md.us. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, 
Washington, DC 20580, www.identitytheft.gov, 1-877-ID-THEFT (1-877-438-4338); TTY: 1-866-653-4261. The 
Federal Trade Commission also encourages those who discover that their information has been misused to file a complaint 
with them. Instances of known or suspected identity theft should also be reported to law enforcement. This notice has not 
been delayed by law enforcement. Rhode Island residents: the Attorney General’s office can be contacted at 
http://www.riag.ri.gov/index.php, consumers@riag.ri.gov or (401) 274-4400. There were approximately 1102 Rhode 
Island residents affected by this incident. 



